dotfiles/nixos/boxes/bolty/woodpecker-agent.nix

114 lines
3 KiB
Nix
Raw Normal View History

2023-01-01 10:22:04 +00:00
{ config, pkgs, inputs, lib, ... }:
let
2022-12-21 14:51:21 +00:00
agentPort = 9000;
domain = "ci.cyplo.dev";
uid = 2061;
gid = 3061;
systemUserName = "woodpecker";
systemGroupName = "woodpecker";
podmanGid = 994;
secretSettings = {
owner = systemUserName;
group = systemGroupName;
};
woodpeckerEnvSecretName = "woodpecker-env";
woodpeckerEnvSecretPath = "/run/secrets/${woodpeckerEnvSecretName}";
2022-12-21 20:11:47 +00:00
woodpeckerNixStorePath = "/var/lib/woodpecker/nix-store";
2022-12-21 14:51:21 +00:00
woodpeckerAgentContainer = {
autoStart = true;
2023-01-01 10:22:04 +00:00
forwardPorts = [ ];
2022-12-21 14:51:21 +00:00
bindMounts = {
"${woodpeckerEnvSecretPath}" = {
hostPath = "${woodpeckerEnvSecretPath}";
isReadOnly = true;
};
2022-12-21 20:11:47 +00:00
"${woodpeckerNixStorePath}" = {
hostPath = woodpeckerNixStorePath;
isReadOnly = false;
};
2022-12-21 14:51:21 +00:00
"/var/run/docker.sock" = {
hostPath = "/var/run/podman/podman.sock";
isReadOnly = false;
};
};
2023-01-01 10:22:04 +00:00
config = { config, pkgs, lib, ... }: {
2022-12-21 14:51:21 +00:00
system.stateVersion = "22.11";
users = {
mutableUsers = false;
allowNoPasswordLogin = true;
users."${systemUserName}" = {
inherit uid;
isSystemUser = true;
isNormalUser = false;
group = systemGroupName;
};
groups."${systemGroupName}" = {
inherit gid;
2023-01-01 10:22:04 +00:00
members = [ "${systemUserName}" ];
2022-12-21 14:51:21 +00:00
};
groups."podman" = {
gid = podmanGid;
2023-01-01 10:22:04 +00:00
members = [ "${systemUserName}" ];
2022-12-21 14:51:21 +00:00
};
};
systemd.services.woodpecker-agent = {
2022-12-21 20:11:47 +00:00
enable = true;
2023-01-01 10:22:04 +00:00
wantedBy = [ "multi-user.target" ];
2022-12-21 20:11:47 +00:00
2022-12-21 14:51:21 +00:00
environment = {
WOODPECKER_SERVER = "${domain}:${toString agentPort}";
WOODPECKER_MAX_PROCS = "1";
WOODPECKER_DEBUG_PRETTY = "true";
2022-12-21 20:11:47 +00:00
WOODPECKER_LOG_LEVEL = "debug";
2022-12-21 14:51:21 +00:00
};
serviceConfig = {
2023-01-01 10:22:04 +00:00
EnvironmentFile = [ woodpeckerEnvSecretPath ];
2022-12-21 14:51:21 +00:00
ExecStart = "${pkgs.woodpecker-agent}/bin/woodpecker-agent";
User = systemUserName;
Group = systemGroupName;
};
};
};
};
in {
2023-01-01 10:22:04 +00:00
imports = [ ../nginx.nix ];
2022-12-21 14:51:21 +00:00
users = {
users."${systemUserName}" = {
inherit uid;
isSystemUser = true;
isNormalUser = false;
group = systemGroupName;
2023-01-01 10:22:04 +00:00
extraGroups = [ "podman" ];
2022-12-21 14:51:21 +00:00
};
groups."${systemGroupName}" = {
inherit gid;
2023-01-01 10:22:04 +00:00
members = [ "${systemUserName}" ];
2022-12-21 14:51:21 +00:00
};
groups."podman" = {
gid = podmanGid;
2023-01-01 10:22:04 +00:00
members = [ "${systemUserName}" ];
2022-12-21 14:51:21 +00:00
};
};
2023-01-01 10:22:04 +00:00
sops.secrets."woodpecker-env" = {
sopsFile = ../vpsfree1/gitea.sops;
format = "binary";
path = woodpeckerEnvSecretPath;
} // secretSettings;
2022-12-21 14:51:21 +00:00
2023-01-01 10:22:04 +00:00
virtualisation.podman = { enable = true; };
2022-12-21 20:11:47 +00:00
systemd.services.woodpecker-make-path = {
script = ''
mkdir -p ${woodpeckerNixStorePath}
chown -R ${systemUserName}:${systemGroupName} ${woodpeckerNixStorePath}
'';
2023-01-01 10:22:04 +00:00
serviceConfig = { Type = "oneshot"; };
2022-12-21 20:11:47 +00:00
};
2022-12-21 14:51:21 +00:00
containers.woodpecker-agent1 = woodpeckerAgentContainer;
2023-01-01 10:22:04 +00:00
systemd.services."container@woodpecker-agent1".requires =
[ "woodpecker-make-path.service" ];
2022-12-21 14:51:21 +00:00
}